PNNL-13501 - Pacific Northwest National Laboratory

Since the implementation of the general anomaly
detection engine can be accomplished in an algorithmindependent
fashion, multiple algorithms could be
empirically tested for preliminary suitability to the task.
The added cost will be minimal while the benefit could be
great.
Initially, standard systems metrics supplied by the
operating system on Windows NT will be used as input
into the general anomaly detection engine. If these
metrics do not provide the required information to detect
anomalies, we can switch to the memory harvester agents
to access any information required. However, we do not
expect this will be the case.
Algorithm Selection Engine
The algorithm selection engine likewise can use an
algorithm that has been studied. The algorithms that have
been considered for this block are commonly used in
decision theory.
Fuzzy Logic
Although not all decisions in this application are fuzzy,
fuzzy logic will not fulfill all decisions required of the
system. Fuzzy logic would be an ideal technology
(Hammell) where approximate reasoning based on those
situations where fuzzy input is available. This technology
might be applicable where a new exploit based on an old
one might be recognized.
Case Based Reasoning
Case based reasoning has limitations in a multi-agent
environment and is unable to capture deep knowledge.
The ability to capture deep knowledge is a requirement
when input data diverges from the norm. This is best for
analogical reasoning. New problems are solved by
analogy with old ones and explanations are stated in terms
of prior experience.
The main disadvantage is the high cost of computation in
obtaining a solution. This method may be appropriate
when an unknown situation is happening. In this
application, this disadvantage is better than doing nothing
or waiting for a human response. Case based reasoning is
most often used in the context of intelligent agents that
address several issues including anticipation,
experimental learning, failure avoidance, goal attainment,
and adaptive behavior.
Case Based Planning
This approach centers on the generation of scenarios (a
collection of examples of future events). The focus is
placed on the cases that are the most relevant to the
success or failure of the given plan. We will not pursue
this path until proactive planning in the cyber security
arena becomes a real need.
Reactive, Planning, Deliberative Components
Under the reactive, planning, deliberative architecture,
information from the environment is perceived and either
a reactive action or a planning action occurs. If the
information is not perceived as an action or a goal,
identification and recognition are needed. If the
information is ambiguous or a goal needs elaboration due
to an unfamiliar environment, then deliberative decision
making takes place in order to commit to achieving a goal
that spawns the planning. The identification and
recognition and planning modules for the reactive,
planning, deliberative components.
Neural Networks and Bounded Neural Networks
The following functions are well suited to artificial neural
networks:
1. pattern classification
2. clustering or categorization
3. function approximation
4. optimization
5. predictions or forecasting
6. content based data retrieval
7. control.
Of particular interest, artificial neural networks have been
used to successfully model the human decision-making
process.
Artificial neural networks provide a cost-effective
alternative to knowledge engineering. In general,
artificial neural networks are a good choice for efficiently
processing large amounts of data in a near real-time
environment.
Disadvantages include
1. cannot transfer their knowledge
2. work on numeric data only
3. cannot use legacy information from other systems.
Computer Science and Information Technology 151